Analysis
- max time kernel
3s - max time network
3s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 15:26
Errors
General
- Target AngryVirus.exe
- Size 482KB
- Sample261024-svkwmacv3k
- SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"C:\Users\Admin\AppData\Local\Temp\AngryVirus.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-S.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR.exeC:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x32c 0x3201⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MasonGDI.exe
MasonMBR-S.exe
MasonMBR.exe
MasonRootkit.exe
memory/436-60-0x0000023823790000-0x00000238237BB000-memory.dmp
memory/436-61-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/612-49-0x00000297F0D80000-0x00000297F0DA5000-memory.dmp
memory/612-50-0x00000297F0DB0000-0x00000297F0DDB000-memory.dmp
memory/612-51-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/676-55-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/676-54-0x00000130EE140000-0x00000130EE16B000-memory.dmp
memory/880-65-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/880-64-0x0000028676660000-0x000002867668B000-memory.dmp
memory/956-71-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/956-70-0x000001DD9F140000-0x000001DD9F16B000-memory.dmp
memory/1016-67-0x000002EBBCFA0000-0x000002EBBCFCB000-memory.dmp
memory/1016-68-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1064-79-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1064-78-0x00000255FBFC0000-0x00000255FBFEB000-memory.dmp
memory/1128-81-0x0000025101C90000-0x0000025101CBB000-memory.dmp
memory/1128-82-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1200-84-0x0000025E3ED30000-0x0000025E3ED5B000-memory.dmp
memory/1200-85-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1224-87-0x000002109C2B0000-0x000002109C2DB000-memory.dmp
memory/1224-88-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1240-91-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1240-90-0x0000023498B70000-0x0000023498B9B000-memory.dmp
memory/1288-94-0x000002184A080000-0x000002184A0AB000-memory.dmp
memory/1288-95-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1316-100-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1316-99-0x0000028F98970000-0x0000028F9899B000-memory.dmp
memory/1392-102-0x000001E5ABDB0000-0x000001E5ABDDB000-memory.dmp
memory/1392-103-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1440-112-0x0000018A22FC0000-0x0000018A22FEB000-memory.dmp
memory/1440-113-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1476-115-0x00000298E8F30000-0x00000298E8F5B000-memory.dmp
memory/1476-116-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1524-119-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1524-118-0x0000020D8A4B0000-0x0000020D8A4DB000-memory.dmp
memory/1664-121-0x00000192D8580000-0x00000192D85AB000-memory.dmp
memory/1664-122-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1684-124-0x0000022337DD0000-0x0000022337DFB000-memory.dmp
memory/1684-125-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1812-127-0x000001E8DC360000-0x000001E8DC38B000-memory.dmp
memory/1812-128-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1840-130-0x0000024670660000-0x000002467068B000-memory.dmp
memory/1840-131-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1908-144-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1908-143-0x000002CB3F360000-0x000002CB3F38B000-memory.dmp
memory/1932-146-0x0000020C19780000-0x0000020C197AB000-memory.dmp
memory/1932-147-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/1944-152-0x00000237C5F70000-0x00000237C5F9B000-memory.dmp
memory/1944-153-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/2012-149-0x0000017044690000-0x00000170446BB000-memory.dmp
memory/2012-150-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/2080-155-0x0000023AD5190000-0x0000023AD51BB000-memory.dmp
memory/2080-156-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/2088-159-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/2088-158-0x0000015998860000-0x000001599888B000-memory.dmp
memory/2156-161-0x000001ECE26E0000-0x000001ECE270B000-memory.dmp
memory/2156-162-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/2216-164-0x0000000001770000-0x000000000179B000-memory.dmp
memory/2216-165-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/2256-168-0x00007FFE12850000-0x00007FFE12860000-memory.dmp
memory/2256-167-0x00000219D8360000-0x00000219D838B000-memory.dmp
memory/2328-170-0x00000194DDD90000-0x00000194DDDBB000-memory.dmp
memory/2980-0-0x0000000000210000-0x000000000028E000-memory.dmp
memory/2980-2-0x000000001ADA0000-0x000000001ADF6000-memory.dmp
memory/2980-1-0x000000001AE60000-0x000000001AE70000-memory.dmp
memory/3336-41-0x00007FFE516F0000-0x00007FFE517AE000-memory.dmp
memory/3336-40-0x00007FFE527D0000-0x00007FFE529C5000-memory.dmp
memory/3440-45-0x0000000006640000-0x00000000066D2000-memory.dmp
memory/3440-42-0x0000000000AB0000-0x0000000000ADA000-memory.dmp
memory/3864-31-0x0000000000FE0000-0x0000000000FF4000-memory.dmp